The IGG.CATLOCK profile, in conjunction with normal security checking, controls who can lock a catalog and who can access a locked catalog.

If you have READ access to the IGG.CATLOCK profile and ALTER authority to the catalog, you can lock or unlock a catalog. If you have READ access to the IGG.CATLOCK profile, you can access and repair a locked catalog. If the IGG.CATLOCK profile is not defined, or the FACILITY class is not active, you cannot lock or unlock a catalog.

In previous releases, a user defined as privileged or trusted to RACF® would automatically have read access to this facility class. However, you must now explicitly authorize those privileged or trusted users to this facility class if they need access to locked catalogs. There are products that are privileged (such as DFSMShsm) because they perform a variety of actions against data sets and catalogs. Without requiring explicit authorization to the facility class, these products could inadvertently access or change locked catalogs, causing damaged catalogs or unexpected results. If these products or components are to be used while accessing a locked catalog, they must be explicitly authorized to the facility class. It is recommended they be authorized only for the duration of the specific need.

To ensure the integrity of catalogs, restrict authority to the IGG.CATLOCK profile to only the necessary people or system components. To define entries in a catalog, users only need UPDATE authority to the data set profile protecting the catalog. Therefore, you should consider specifying UACC(UPDATE) for the data set profiles protecting user catalogs. To delete entries in a catalog, users need either ALTER authority to the data set or ALTER authority to the catalog. We recommend that you only give users ALTER authority to their own data sets.

See Locking a Catalog for an explanation of catalog locking and Recovering a BCS for an example of locking a catalog during recovery.